Boosting cyber capabilities

A report indicating a Chinese attack on critical Indian infrastructure should lead to a review

Asuspected Chinese cyber campaign began targeting critical Indian infrastructure assets sometime in the middle of 2020, American cyber intelligence company Recorded Future said. First reported by The New York Times, the company’s analysis identified a sophisticated campaign by actors who used tools and digital infrastructure that has independently been attributed to China-linked cyber offensives. According to the company, the campaign was designed to intrude into the electricity infrastructure, including the main load dispatch centres that hold up India’s power grid. One of these centres, in Maharashtra, suffered an outage in October 2020, which is being investigated.

Government officials suggested a cyberattack , much less one by a nation-State, was not responsible for the outage that cut power to India’s financial capital for up to 12 hours. But they received inputs of a campaign targeting such utilities. This is often the nature of an attack of this kind — it is hard to investigate and harder still to conclusively attribute. And this opaqueness has been leveraged by nations to send adversaries a message. The United States (US), Russia, Israel and China have been behind such attacks in the past. In most, the targets have been critical public utilities and sensitive industries such as financial institutions and government assets. The first known cyberattack on a power grid was, in fact, attributed to Russian actors who took Ukrainian electricity infrastructure offline for one to six hours.

Irrespective of whether there is conclusive evidence, the threat of Chinese cyber soldiers striking at India is grave. According to the Harvard Kennedy School’s Belfer Centre, as of 2020, China ranks only second to the US in having the skills to pursue cyber objectives. But where it lacks skill, it makes up for intent — earning an overall cyber power index rank of two among 30 countries. India, with low intent as well as capability, ranks 21. Cyber experts have long pointed out this asymmetry in capabilities between India and its adversaries and how engagement in the cyber domain is not limited to rules of realworld conflict. Conventional military defences now may be inadequate in avoiding large disruptive attacks that can force cities offline, grounding industries, hospitals and transport. The report is a reminder for India to expedite defensive as well as offensive capabilities in the cyber domain, where the threat of retaliation is often a more potent deterrent than any other posturing.